CVE-2025-68457
JavaScript Injection via Data Attributes in Orejime
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| boscop-fr | orejime | 2.3.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68457 is a vulnerability in the Orejime consent manager prior to version 2.3.2, where malicious code can be executed by embedding `javascript:` URLs within data attributes of HTML elements. When a user consents to a related purpose, Orejime converts these data attributes (like `data-href`) into normal attributes (`href`), causing the embedded JavaScript code to run. This can lead to code injection or cross-site scripting attacks if an attacker can inject HTML into pages using Orejime. The issue was fixed by enforcing URL validation to disallow dangerous schemes such as `javascript:`. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow an attacker who is able to inject HTML code into pages using Orejime to execute arbitrary JavaScript code in the context of the affected site. This can lead to cross-site scripting (XSS) attacks, potentially compromising user data, session tokens, or performing actions on behalf of users without their consent. However, the risk is limited because Orejime typically handles hardcoded elements, and the vulnerability only arises if HTML injection is possible. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting HTML elements handled by Orejime prior to version 2.3.2 for the presence of data attributes containing `javascript:` URLs that could be converted into executable attributes (e.g., `data-href="javascript:..."`). Detection involves searching for such patterns in your web pages or application code. For example, you can use command-line tools like grep to scan your codebase or served HTML files for occurrences of `data-href="javascript:` or similar patterns. A sample command might be: `grep -r 'data-href="javascript:' ./path-to-your-web-files`. Additionally, monitoring network traffic for suspicious payloads containing `javascript:` URLs in data attributes could help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Orejime to version 2.3.2 or later, where the vulnerability is fixed by enforcing URL validation to disallow `javascript:` schemes. If upgrading is not immediately possible, sanitize any attributes that could contain executable code outside of Orejime to prevent injection of malicious URLs. This means ensuring that data attributes like `data-href` do not contain `javascript:` or other executable schemes before they are converted into unprefixed attributes. Implementing strict input validation and sanitization on any user-supplied HTML or attributes is also recommended. [2, 1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. The vulnerability involves potential code execution through malicious URL schemes in HTML attributes, which could pose security risks if exploited, but there is no explicit mention of compliance implications in the resources. [1, 2]